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“This guideline has been prepared t to help employers, wor ers, ‘supervisors, , members 


Introduction 


Making sure that worker health records are kept confidential is fundamental to a 
successful occupational health service. Honest communication between a worker and a 
health professional is possible only when the worker is sure that personal information will 
be maintained in confidence. Without this trust, health professionals are limited in their 
ability to assess the health of workers and give them the most appropriate care. 


In particular, when a health professional giving care to a worker is employed by, or 


under contract to, the worker’s employer, questions about the handling of the worker’s 
health records can arise. 


This guideline answers commonly asked questions on the appropriate handling of worker 
health records and considers both regulatory requirements and current accepted practice. 
It will be useful to employers, workers, supervisors, members of joint health and safety 
committees and occupational health personnel. 
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Regulatory Requirements in Ontario 


A) The Regulated Health Professions Act, 1991 


Many health professionals have obligations under this Act as well as in the common 
law to maintain health records in confidence. Employers and workers should be 
aware of these obligations. In particular, occupational health professionals should 
advise all workplace parties of their responsibility to protect the privacy of worker 
health records. 


B) The Occupational Health and Safety Act 


Two subsections of the Occupational Health and Safety Act (the OHSA) deal with 
confidentiality of worker health records: 


>» Subsection 63(1)(f) of the OHSA prohibits disclosure by any person of any 
information obtained in any medical examination, test or x-ray of a worker 
made or taken under the OHSA except in a form that would prevent identifi- 
cation of a particular person or case. 


This prohibition pertains only to medical examinations, tests or x-rays. made or 
taken under the OHSA. Examples would be tests and examinations done for 
the medical surveillance outlined in the designated substance regulations. 


>» In 1991 subsection 63(2) of the OHSA was amended to restrict access by 
employers to worker health records without the worker’s written consent. The 
intent is protection of the privacy of workers with respect to all information 
kept in their health records. 
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Questions and Answers 


1) 


2) 


How does subsection 63(2) of the OHSA restrict employer access to worker 
health records? 


Subsection 63(2) states: 


"No employer shall seek to gain access, except by an order of the 
court or other tribunal or in order to comply with another statute, to 
a worker health record concerning a worker without the worker’s 
written consent." 


Except for the conditions set out in this subsection, the employer must obtain the 
worker’s written consent before seeking to gain access to any information in a 
worker’s health record. "Seeking to gain access" includes asking for the use of a 
worker health record, collecting health information or enquiring about information 
contained in the record. 


The employer must ensure that all persons who act on behalf of the employer, 
including all persons with managerial and supervisory duties, comply with this 
section. 


What is meant by the term "worker health record" in subsection 63(2)? 


A “worker health record" includes information collected in the course of evaluating 
the health of a worker or providing health care to a worker. The term is not 
restricted to records collected under the OHSA. 


Examples of information that could be part of a “worker health record" are: 
e physicians’ or nurses’ notes; 
e pre-placement and periodic medical examination and health assessment 
data; 
e results of clinical tests, e.g. x-ray, blood analysis and lung function 
tests; 
e results of screening tests, e.g. audiometric, tuberculin and vision tests; 
and 
e other reports from health professionals on the health of a worker. 
Any questions about information falling into categories not given above should be 


reviewed case by case. Items usually considered part of a health record in the 
ordinary practice of a health professional would be part of the "worker health 


record". 
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3) 


4) 


If access to worker health records is restricted to a "health professional", who 
is considered to be a health professional? 


The Regulated Health Professions Act contains a list of the health care providers 
regulated under it. Health professionals are generally considered to be individuals 
who provide direct health care to a worker or who evaluate the health of a worker, 
whether in the workplace or outside it. 


Direct health care may be provided to a worker by the family physician, physicians 
practising medical specialties, including occupational medicine, or an occupational 
health nurse (who often provides care right in the workplace). With the 
development of occupational health programs, other health professionals may be 
directly involved in workplace health and rehabilitation programs, both in the 
workplace and outside it. These include physiotherapists, occupational therapists, 
psychologists, audiologists and others. 


Who should control worker health records? 


To ensure compliance with the restrictions on access set out in subsection 63(2) (see 
Question 1), health records should be controlled by the occupational health team 
involved in providing direct care to the individual. 


How should access to worker health records of laid-off and terminated workers 
be handled? 


Access to health records of laid-off or terminated workers should be handled in the 
same confidential manner as access to health records of currently employed 
workers. 


How should information from worker health records be handled when it is to 
be used in health studies? 


If information is to be taken from worker health records for health studies, 
appropriate procedures must be in place to make sure that confidentiality is 
maintained. For example, this might include removing all personal identifiers. In 
other words, the information released must contain nothing that could identify it 
with a particular person or case. 
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8) 


9) 


What should employers and workers know about written consents authorizing 
the release of health information under subsection 63(2) of the OHSA? 


First, intimidation or coercion must not be used when seeking written consent for 
access to a worker’s health record. A recent decision by the Ministry of Labour’s 
Office of Adjudication is relevant. It concerned an appeal involving alleged 
coercion of a worker to sign a written consent for access to his health record. The 


decision reaffirms that intimidation cannot be used to obtain consent for access to 
worker health records. 


Second, the written consent does not have to cover all the information in the health 
record. For example, the consent may be limited to information about a particular 
illness or injury. It may also be limited to information about a certain period of 
time. Workers should be aware that they can specify what information is to be 
released from their health records and to whom it is to be released. 


May employees obtain information from their own health records? 


Current trends favouring the right of individuals to receive information about 
themselves were noted in a recent Supreme Court decision supporting the patient’s 
right to examine his or her medical record. 


Employers should have a policy in place that describes procedures under which 
employees can have access to their own health records. Note that regulations under 
the Regulated Health Professions Act may have specific requirements for providing 
information to a worker. 


Another important reason why employees have access to their own records is to 
ensure accuracy. Institutions subject to freedom of information legislation are 
required to provide this access specifically for the purpose of correcting errors. 


Does the employer have access to the records of first aid treatments given on 
the job? 


The Regulation Respecting First Aid Requirements, made under the Workers’ 
Compensation Act, requires that the employer keep a record of the date, time and 
nature of each first aid treatment given in all cases of injury on the job (R.R.O. 
1101, section 5). 


When the record of the first aid treatment is made by a health professional and 
added to the worker’s health record, only the first aid information may be given to 
the employer without the worker’s written consent. Access by the employer to any 
other information in the health record requires the worker’s written consent, as 


outlined above. 
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10) 


11) 


12) 


What information can an employer expect to receive from a_ health 
professional? 


A health professional may conduct pre-placement or periodic medical or health 
assessments as part of the company’s occupational health program (for example, as 
part of medical surveillance regarding designated substances). In some cases, a 
health professional may also conduct a medical assessment to determine a worker’s 
ability to return to work following illness or injury. 


The information obtained during such assessments is part of the worker’s health 
record and must be kept confidential. 


However, the health professional could provide the employer with a report on the 
worker’s fitness to perform the essential duties of a particular job and any 
limitations of the worker that pertain to the performance of the job. For such a 
report to be made, the employer must communicate the requirements of the job to 
the health professional. 


Note that recent amendments to the Workers’ Compensation Act require that a 
health professional have the worker’s consent before releasing a report to the 
employer and the board. Any regulations applicable to the report must also be 
satisfied. 


In another recent development, the Canadian Medical Protective Association has 
advised occupational physicians to obtain the worker’s consent before providing 
employers with information on his or her fitness to return to work. (For further 
information, contact the CMPA.) 


Does it matter whether the health professional conducting a medical or health 
assessment is acting on behalf of the employer or at request of the worker? 


In either case, the obligations are as stated in answer to Question 10. 


What is the status of information that a worker provides to the employer by 
giving him a note from a physician regarding absence from work or work limit- 
ations? Isn’t this confidential? 


As stated previously, information on a worker’s health or disability may be 
provided to a third party, such as the employer, if the worker consents. If the 
worker freely gives the employer a note, the worker’s action indicates consent to 
the employer’s having the information in that note. For example, if the worker 
freely gives the employer a physician’s note containing a medical diagnosis, the 
worker has consented to the employer’s having that diagnosis. 


Thus if workers do not wish to disclose certain medical information when giving 
the employer a physician’s note, it is important that they make sure that the note 
contains only information about their ability to perform the job. 
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13) Do notification provisions under subsection 52(2) of the OHSA require the 
employer to have access to worker health records? Do they entitle the 
employer to have such access? 


Briefly, the answer to both questions is no. 


Under the notification provisions of subsection 52(2) of the OHSA, if a worker (or 
a former worker) or someone acting on behalf of a worker advises the employer 
that the worker has an occupational illness, or that a claim has been filed with the 
WCB, the employer is required to notify: 

e the Ministry of Labour, 


¢ the joint health and safety committee or a health and safety representative 
(if any), and 
e the trade union (if any) 
of the occurrence of the occupational illness. The employer must give this notifica- 
tion in writing within four days of being advised of the illness or WCB claim. The 
main purpose of this is to ensure that the employer takes steps to prevent the 
recurrence of the illness. 


When a worker tells the employer that he or she has an occupational illness and 
states what happened to cause it, the employer’s notification needs to give only this 
information, along with the other particulars required by regulations under the 
OHSA (see "Note" below). There is no requirement to include a medical diagnosis 
or a description of the illness. 


Thus the employer is not required (or entitled) to have access to such information 
in the worker’s health record under subsection 52(2). 


Note: In addition to the requirements of subsection 52(2), regulations under the 
OHSA covering different workplace sectors specify information to be included in 
notifications of an occupational illness. These regulations include: O.Reg. 213/91 
(construction); R.R.O. 854 (mining); O.Reg. 67/93 (health care); and R.R.O. 851 
(industrial establishments). 
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14) 


15) 


In giving notice of occupational illness required under subsection 52(2) of the 
OHSA, should the employer provide a copy of the Workers’ Compensation 
Board’s "Employer’s Report of Injury/Disease" (WCB Form 7)? 


Employers should not use WCB Form 7 to comply with the notification require- 
ments under subsection 52(2) of the OHSA. They must provide only the particular 
information prescribed in the regulations under the OHSA and must see that the 
information goes only to the appropriate party. 


Many employers have submitted copies of WCB Form 7 to comply with notification 
requirements under the OHSA. However, both the provincial and municipal 
privacy legislation (the Freedom of Information and Protection of Privacy Act and 
the Municipal Freedom of Information and Protection of Privacy Act) prohibit the 
collection and disclosure of information unless it is specifically authorized by a 
particular statute and regulations under it. Form 7 contains considerably more 
personal information than is required in the notification requirements of the OHSA. 


Do the privacy provisions set out in the Freedom of Information and Protection 
of Privacy Act and the Municipal Freedom of Information and Protection of 
Privacy Act prevent provincial or municipal employers from complying with the 
various notice obligations under the OHSA? 


This question arises because the OHSA requires employers to disclose certain per- 
sonal information, while the privacy legislation mentioned above seem to forbid 
disclosure. 


More specifically, the OHSA’s notice provisions require employers to share several 
categories of information about workers with the ministry, joint health and safety 
committees or health and safety representatives and trade unions (where applicable). 
These categories include personal information that would normally be restricted 
under the privacy legislation covering provincial and municipal employers. 


However, under both the provincial and the municipal privacy legislation, disclosure 
of personal information is permissible if that disclosure is for the purpose of 
complying with another statute. Therefore, it is appropriate to disclose the informa- 
tion explicitly referred to in the OHSA and regulations under it. The disclosure of 
such information must, however, be in strict compliance with the disclosure 
provisions of the privacy legislation. 


WCB Form 7 should no longer be used to satisfy the notice obligations. 


Confidentiality of Worker Health Records 


a Ee OE TN AOE a SP Sa Re EN 


16) 


17) 


18) 


How should worker health records be maintained? 


It is the responsibility of the health professional to see that worker health records 
are maintained in confidence. The health professional must ensure that all staff who 
handle worker health records keep all information contained in them confidential. 


When an occupational health professional is employed at the workplace, health 
records are generally maintained by him or her on site. When an occupational 
health service is provided to a company by an outside agency, it is the responsibility 
of the agency to maintain the health records. 


Worker health records should not be maintained in the company’s personnel files 
but in a separate filing system in a secure place. 


If worker health information is stored electronically, access should be restricted by 
appropriate means. Procedures should be in place to protect the information from 
destruction and unauthorized alteration. The same principles for access, mainten- 
ance and disposition that apply to paper health records apply to electronically stored 
health records. 


Should worker health records ever be sent by fax? 


The use of facsimile (fax) transmission of worker health information is discouraged 
except when particular information is required for the immediate treatment of a 
worker. If worker health information must be sent by fax it should handled with 
special care. In particular, it is recommended that all personal identifiers be 
removed. A confidential means of identification should be used instead: for 
example, a file number or a registration number. 


How long must worker health records be retained? 


There are several regulatory requirements for retention of worker health records. 
Regulations being developed under the Regulated Health Professions Act will 
include requirements for record retention by health professionals. For further 
information on record retention, contact the appropriate professional regulatory 
body: i.e., the College of Nurses of Ontario, the College of Physician and Surgeons 
of Ontario, etc. 


The designated substance regulations under the OHSA require worker medical and 
exposure records to be maintained, in a secure place, by the examining physician 
for whichever of the following periods ends later: 


e forty years from the time the first entry in the record was made, 


or 
e twenty years from the time the last entry in the record was made. 
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19) 


How should the disposition of worker health records be handled in the 
following cases? 


Case A: The health records have been kept for the required period of time. 


The health records may be either forwarded to the worker’s physician, with the 
worker’s consent, or destroyed in a manner that ensures confidentiality. 


Case B: The examining physician or a successor is no longer able or willing to 
keep the health records required by designated substance regulations made under 
the OHSA. 


The records must be forwarded to the Provincial Physician of the Ministry of 
Labour, who will store them in a secure place for the prescribed times. 


Case C: A workplace either closes down or ceases to provide an occupational 
health service. 


In either circumstance, options to consider include I to TV below. It should be 
noted that these options apply only to health records NOT made under the 
designated substance regulations of the OHSA. 

The most acceptable option(s) for a workplace that is closing or no longer 
providing occupational health service should be selected after consultation with 
the health professionals and with appropriate worker consent. 


Option I 
Transfer the health records to an occupational health service at another 
location within the company. (The records would then be maintained by 
the health professional at that location). 
Option II 
Transfer the health records to an occupational health service or agency or 
to a health professional outside the company. 
Option III 
Transfer the health records to the worker or the worker’s physician. 
Option IV 
Transfer the health records to a senior management official to be main- 
tained in a secure place. 


If this option is chosen, a letter of agreement should be signed by the 
health professional and by the senior manager outlining the manager’s res- 
ponsibility to maintain health records in a confidential manner. The letter 
of agreement should indicate that the manager will ensure that no worker 
health information will be accessed or released without the written consent 
of the worker except as provided for in subsection 63(2) of the OHSA. 
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20) What measures can be taken at the workplace to avoid misunderstanding about 
the handling of worker health records? 


To avoid misunderstanding and conflict over the handling of worker health records, 
employers should develop a written policy on confidentiality of health records. 


This policy should be developed in consultation with joint health and safety commit- 
tees, worker health and safety representatives and occupational health personnel. 
It should describe the procedures for collection, maintenance, access and disposition 
to be followed by those responsible for maintaining the health records. The policy 
should be clearly communicated to all managers and employees. 


Finally, since acceptable practice involving privacy obligations and confidentiality 
issues is constantly evolving, this policy should be periodically reviewed and, if 
necessary, revised to ensure that it reflects current practice. 


For More Information 


For more advice or information on the handling of worker health records, please 
contact a nurse or doctor who is on staff as a consultant at one of the following 
Ministry of Labour offices: 


Central Area Office (Mississauga) Northern Area Office (Sudbury) 
(905) 273-7800 (705) 670-7217 
Toll free: 1-800-268-2966 Toll free: 1-800-461-6325 
Eastern Area Office (Ottawa) Thunder Bay District Office 
(613) 228-8050 (807) 475-1691 
Toll free: 1-800-267-1916 Toll Free: 1-800-465-5016 
Hamilton/Niagara Area Office Toronto Area Office (Scarborough) 
(Hamilton) (416) 314-5336 
(905) 577-6221 
Toll free: 1-800-263-6906 
Kitchener District Office Western Area Office (London) 
(519) 885-3378 (519) 439-2210 
Toll Free: 1-800-265-2468 Toll free: 1-800-265-1676 


Please see the map "Ministry of Labour Service Areas" on the next page. 
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